CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

Linux Distros Unpatched Vulnerability : CVE-2026-61725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker- supplied 7z archive can write or overwrite files outside...

DEBIAN-CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

EUVD-2026-114537

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725

The sevenz-rust2 Rust-native 7z compressor/decompressor (prior to version 0.21.1 ) is vulnerable to a path traversal issue in src/util/decompress.rs. The decompress_impl function fails to normalize UTF-16 entry names or verify containment when computing destination paths using dest.join(entry.nam...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and "decompress"or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In "src/util/decompress.rs", "decompressimpl" computes each destination with "dest.joinentry.name" without...

RUSTSEC-2026-0245 Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

Summary All versions of sevenz-rust fail to validate file paths when extracting in decompressimpl the underlying function used in the exposed decompress api functions. This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such as...